VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 13)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,564 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 13)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
LearnPress – Course Review≤4.2.2Update to 4.2.3
CVE-2026-118054—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes≤10.3.2Update to 11.0.0
CVE-2026-119098—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
MotoPress Appointment Booking≤2.4.8Update to 2.4.9
CVE-2026-120741—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Email Field
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.6Update to 5.7.7
CVE-2026-119152—
Medium5.3Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-120555—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
Kubio AI Page Builder≤2.9.4Update to 2.9.5
CVE-2026-115816—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
WPBakery Page Builder≤9.0.1Update to 9.1
CVE-2026-119165—
Medium5.9Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-120737—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta
Jupiter X Core≤4.62.0Update to 4.63.0
CVE-2026-119219—
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title
JS Help Desk – AI-Powered Support & Ticketing System≤5.0.2Update to 5.0.3
CVE-2026-118046—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.6Update to 3.13.7
CVE-2026-120540—
High8.8Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
Interactive Real Estate – Floor Plan & Building Visualizer≤2.6.0Update to 2.6.1
CVE-2026-104913—
Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix
Greenshift – animation and page builder blocks≤13.2.2Update to 13.2.3
CVE-2026-119218—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
Social Slider Feed – Social Media Feed & Gallery Widgets≤2.3.8Update to 2.3.9
CVE-2026-121519—
Medium5.3Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter
Greenshift – animation and page builder blocks≤13.2.2Update to 13.2.3
CVE-2026-120520—
High7.2Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.200Update to 2.8.201
CVE-2026-120082—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content
FV Flowplayer Video Player≤7.5.56.7212Update to 7.5.57.7212
CVE-2026-121515—
Medium5.4Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.50Update to 1.15.51
CVE-2026-118067—
Low3.7Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed
Fluent Support – Helpdesk & Customer Support Ticket System≤2.4.7Update to 2.5.0
CVE-2026-119213—
High7.2Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.50Update to 1.15.51
CVE-2026-120512—
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred≤4.0.2Update to 4.0.3
CVE-2026-123471—
High7.2Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter
VikBooking Hotel Booking Engine & PMS≤1.8.17Update to 1.8.18
CVE-2026-93429—
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )≤9.12.2Update to 9.12.3
CVE-2026-118056—
Medium5.3Missing Authorization
Advanced Appointment Booking & Scheduling≤2.6Update to 2.7
CVE-2026-81422—
Critical9.8Unauthenticated Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin≤1.1.11No patch available
CVE-2026-123751—
Medium4.3Missing Authorization
GemBooking – Appointment Booking, Booking Calendar & Reservations≤1.7.0Update to 1.7.1
CVE-2026-123131—
Medium5.3Unauthenticated Team Member Double-Booking
GemBooking – Appointment Booking, Booking Calendar & Reservations≤1.7.0Update to 1.7.1
CVE-2026-123128—
Medium4.3Two-Factor Authentication Bypass
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…≤2.10.0Update to 2.11.0
CVE-2026-123091—
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Fusion Page Builder≤1.7.0Update to 1.7.1
CVE-2026-121759—
Medium4.3Missing Authorization
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes≤4.2.0Update to 4.3.1
CVE-2026-120851—

Search VulnCrest Radar

Jump to

Are you sure?